Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm developing an app that will store a lot of files, and in case of images, it will resize them and save the different thumbnails we need, so when a user uploads an image, it will save more 8 files (this is needed).

To avoid duplicated files and to save space on my static hosting server, my app is saving the file name as "MD5.BYTE_SIZE" (ex: 054d995efa7e9c91569d205d24a2b486.188154)

I've used this file scheme already on another clients without any problems, but I need to know, specifically to this project, if there exists the possibility of the user sending a file with the same MD5, and same size length.

If so, what's the best way to save my file names? With two different hashes (like MD5.SHA-256.BYTE_SIZE)?

share|improve this question

closed as not constructive by Ƭᴇcʜιᴇ007, TFM, 8088, Tog, Nifle Mar 3 '13 at 19:38

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

This has already been covered here:… They describe the probability as "vanishingly small". – Austin ''Danger'' Powers Feb 25 '13 at 3:57
Google "cryptographic hash". – Daniel R Hicks Feb 25 '13 at 4:35
up vote 4 down vote accepted

For practical purposes, zero, unless the user actively tries to create two files that have the same hash, which is possible with MD5.

If you use SHA-256 instead, "zero" (for practical purposes) even if the user actively tries to create two files with the same size.

The exact probability is somewhere around 1/2^128 for two different files to generate the same hash. Due to the birthday paradoxon, you would need around 2^64 files until there is a 50% chance that two will have the same hash. Do not worry about it in practice. For SHA256, the numbers are 1/2^256 and 2^128, respectively. These numbers are also known as "not going to happen".

share|improve this answer
So, if my file name for each file were (MD5.SHA-256.BYTE_SIZE) the probability would be arround 1/2^128 * 1/2^256 ? – CuSS Feb 25 '13 at 4:05
It would still be "zero for all practical purposes". Your calculation is correct, but the birthday paradox numbers may be more relevant to your application. The main advantage of using different hash functions is that attacks against a single function will not work. If someone manages to create two files that have the same SHA256 hash, he is famous and a lot of security stuff is broken. If someone manages to find two files that have the same MD5 and SHA256, the NSA will take care of him for you ;-) And we are talking about an attacker who can decide the content of both files, not just one. – Jan Schejbal Feb 25 '13 at 4:20

It is theoretically possible, but in reality the chance of two different files having the same MD5 checksum is vanishingly small.

So small, in other words, that you can essentially treat this event as impossible as far as your program is concerned.

share|improve this answer
My concern about this is if an malign user tries to upload an image with modified bytes, from the original, could replace my real data. – CuSS Feb 25 '13 at 4:01
@CuSS, add a little logic to your upload code that prevents overwriting, perhaps by date or by username. one three-column data table would do ya. – Frank Thomas Feb 25 '13 at 4:34
@CuSS - Just don't allow an image to be replaced if it already exists. – Ramhound Feb 25 '13 at 13:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.